Weak Authentication

org.eclipse.jetty, jetty-openid is vulnerable to Weak Authentication. The vulnerability is caused by a logical programming defect in the validateRequest function in the OpenIdAuthenticator.java class which allows current requests to still proceed even when LoginService does return that the...

org.eclipse.jetty:jetty-home (>=9.4.21.v20190926, <=9.4.51.v20230217), org.openl.rules.demo:openl-demo-app (5.26.0) potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (>=9.4.21.v20190926, <=9.4.51.v20230217)

org.eclipse.jetty:jetty-openid MAVEN version =9.4.21.v20190926, =9.4.21.v20190926, =9.4.51.v20230217 - org.openl.rules.demo:openl-demo-app 5.26.0 Source cves: CVE-2023-41900 Source advisory: MEND:CVE-2023-41900...

CVE-2023-41900

Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty OpenIdAuthenticator uses the optional nested LoginService, and that LoginService decides to revoke an already authenticated user, then the...

org.eclipse.jetty:jetty-home (>=9.4.21.v20190926, <=9.4.50.v20221201), org.openl.rules.demo:openl-demo-app (5.26.0) potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (>=9.4.21.v20190926, <=9.4.50.v20221201)

org.eclipse.jetty:jetty-openid MAVEN version =9.4.21.v20190926, =9.4.21.v20190926, =9.4.50.v20221201 - org.openl.rules.demo:openl-demo-app 5.26.0 Source cves: CVE-2023-41900 Source advisory: GHSA-PWH8-58VV-VW48...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.1.0), dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.1.0) +1 more potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (11.0.15)

org.eclipse.jetty:jetty-openid MAVEN version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-openid and may be impacted: - dev.dsf:dsf-bpe-server-jetty =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.1.0 Source cves: CVE-2023-41900...

GHSA-PWH8-58VV-VW48 Jetty's OpenId Revoked authentication allows one request

If a Jetty OpenIdAuthenticator uses the optional nested LoginService, and that LoginService decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be...

org.eclipse.jetty:jetty-home (>=9.4.21.v20190926, <=9.4.51.v20230217), org.openl.rules.demo:openl-demo-app (5.26.0) potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (>=9.4.21.v20190926, <=9.4.51.v20230217)

org.eclipse.jetty:jetty-openid MAVEN version =9.4.21.v20190926, =9.4.21.v20190926, =9.4.51.v20230217 - org.openl.rules.demo:openl-demo-app 5.26.0 Source cves: CVE-2023-41900 Source advisory: OSV:GHSA-PWH8-58VV-VW48...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.1.0), dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.1.0) +1 more potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (11.0.15)

org.eclipse.jetty:jetty-openid MAVEN version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-openid and may be impacted: - dev.dsf:dsf-bpe-server-jetty =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.1.0 Source cves: CVE-2023-41900...